nobu	2010-07-23 09:02:51 +0900 (Fri, 23 Jul 2010)

  New Revision: 28728

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=28728

  Log:
    * re.c (rb_reg_expr_str): fixed out-of-boundary access at invalid
      multibyte characters.

  Modified files:
    trunk/ChangeLog
    trunk/re.c

Index: ChangeLog
===================================================================
--- ChangeLog	(revision 28727)
+++ ChangeLog	(revision 28728)
@@ -1,3 +1,8 @@
+Fri Jul 23 09:02:43 2010  Nobuyoshi Nakada  <nobu@r...>
+
+	* re.c (rb_reg_expr_str): fixed out-of-boundary access at invalid
+	  multibyte characters.
+
 Fri Jul 23 09:00:05 2010  Nobuyoshi Nakada  <nobu@r...>
 
 	* configure.in (XCFLAGS): reverted mistakenly removed option.
Index: re.c
===================================================================
--- re.c	(revision 28727)
+++ re.c	(revision 28728)
@@ -370,18 +370,20 @@
 		rb_str_buf_cat(str, p, clen);
 	    }
 	    else if (c == -1) {
-                int l;
+		clen = rb_enc_precise_mbclen(p, pend, enc);
+		if (!MBCLEN_CHARFOUND_P(clen)) {
+		    c = (unsigned char)*p;
+		    clen = 1;
+		    goto hex;
+		}
 		if (resenc) {
 		    unsigned int c = rb_enc_mbc_to_codepoint(p, pend, enc);
-		    l = rb_enc_codelen(c, enc);
 		    rb_str_buf_cat_escaped_char(str, c, unicode_p);
 		}
 		else {
-		    l = mbclen(p, pend, enc);
-		    rb_str_buf_cat(str, p, l);
+		    clen = MBCLEN_CHARFOUND_LEN(clen);
+		    rb_str_buf_cat(str, p, clen);
 		}
-		p += l;
-		continue;
 	    }
 	    else if (rb_enc_isprint(c, enc)) {
 		rb_str_buf_cat(str, p, clen);
@@ -389,6 +391,7 @@
 	    else if (!rb_enc_isspace(c, enc)) {
 		char b[8];
 
+	      hex:
 		snprintf(b, sizeof(b), "\\x%02X", c);
 		rb_str_buf_cat(str, b, 4);
 	    }

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/